> [!WARNING]
> **DEPRECATED**: As of Round 6, the S3RV1C3agent Bash engine has been completely replaced by the compiled C++ Engine (
nx / 669427-engine). This document is retained for historical audit context only.

# TOOL MANIFEST — Source of Truth
## ⚠️ THIS FILE NEVER LEAVES Y:\ — ADMIN WORKSTATION ONLY ⚠️

**Last Updated:** 2026-06-11
**Purpose:** Maps real tool names → disguise names → node assignments → s3rv1c3agent commands

> **🚨 RULE 52 — READ BEFORE ANY CHANGE 🚨**
> Every change follows: **READ RULES → EDIT LOCAL (Y:\) → DOCUMENT → PUSH → TEST → LOG PASS/FAIL**
> Never edit files directly on servers. Never skip documentation. Never rebuild existing systems.
> See `rules.md` Rule 52 for the full mandatory lifecycle.

---

## Naming Conventions

### Family 1: `svc*` — Service/Infrastructure Tools
Pattern: `svc` + short word. Looks like generic Linux service management.
Used for: system hardening, monitoring, file integrity, permissions, firewall

### Family 2: `*mail` — Engine-Facing Tools  
Pattern: action-word + `mail`. Looks like mail server administration.
Used for: commands that talk to the ENGINE API, payments, crypto, AI
Supports Node 6 cover identity as `chess.io` mail service.

### Family 3: `cfg*` — Configuration Management (NEW)
Pattern: `cfg` + short word. Looks like config management utilities.
Used for: rotation, backup, DNS management, network tools

### Family 4: `sys*` — System Utilities (NEW)  
Pattern: `sys` + short word. Looks like systemd-related utilities.
Used for: health checks, runtime management, integrity verification

---

## Currently Deployed Tools (Engine Node 006)

| Disguise Name | Agent Command | Real Purpose | Status |
|--------------|---------------|-------------|--------|
| `svcbeat` | `hb_send` | Heartbeat sender | ✅ DEPLOYED |
| `svcboot` | `bs_init/generate/install` | Bootstrap / init | ✅ DEPLOYED |
| `svccfg` | — | Config manager | ✅ DEPLOYED |
| `svcfile` | `fm_init/check/monitor` | File integrity monitor | ✅ DEPLOYED |
| `svcfw` | `fr_rotate` | Firewall management | ✅ DEPLOYED |
| `svclock` | `ld_*` | Lockdown controller | ✅ DEPLOYED |
| `svclog` | `lm_init/monitor` | Log monitor | ✅ DEPLOYED |
| `svcpass` | `pr_rotate` | Password rotation | ✅ DEPLOYED |
| `svcperm` | `per_rotate` | Permission hardening | ✅ DEPLOYED |
| `svcrotate` | `kr_init/rotate/rotate_all` | Key rotation (WG/SSH) | ✅ DEPLOYED |
| `svctrap` | `ca_init/plant/monitor` | Canary traps | ✅ DEPLOYED |
| `askmail` | `ai_query` | AI query (Ollama) | ✅ DEPLOYED |
| `cmdmail` | `cmd_recv` | Command receiver | ✅ DEPLOYED |
| `dbwrite` | — | DB write operations | ✅ DEPLOYED |
| `getmail` | `vault_fetch` | Vault key fetch | ✅ DEPLOYED |
| `logmail` | `event_send` | Event logging | ✅ DEPLOYED |
| `mailcli` | — | CLI tool | ✅ DEPLOYED |
| `mailctl` | — | Master controller (s3rv1c3agent) | ✅ DEPLOYED |
| `paymail` | `payment_check` | Payment verification | ✅ DEPLOYED |
| `pollmail` | `health_poll` | Health polling | ✅ DEPLOYED |
| `unmail` | `decrypt` | Decrypt operations | ✅ DEPLOYED |
| `hello` | — | 3-phase init script | ✅ DEPLOYED |
| `s3rv1c3agent` | — | Master agent daemon | ✅ DEPLOYED |
| `se_client.sh` | — | Shared HMAC library | ✅ DEPLOYED |

---

## New Tools — From Legacy Bash (Y:\done\legacy\bash\)

### SECURITY TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `password.sh` | `svcpass` | ALL | `pr_rotate` | Service credential rotation (GPG-encrypted store, auto-heal, rollback) |
| `ghost_key_rotation.sh` | `svcrotate` | Shield(4) | `kr_rotate_all` | WireGuard key rotation with peer push + tunnel verify |
| `lockdown.sh` | `svclock` | ALL | `ld_activate/deactivate/escalate/kill_switch` | 4-level lockdown (low→critical), nftables enforcement |
| `security-audit.sh` | `sysaud` | ALL | `sa_run` | Full security audit (ports, perms, users, certs) |
| `security-auth.sh` | `sysauth` | Shield(4), Origin(5) | `sa_auth` | Auth hardening (PAM, SSH, sudo) |
| `security-crypto.sh` | `syscrypt` | Engine(6) | `sa_crypto` | Crypto key validation, entropy check |
| `security-detect.sh` | `sysdet` | ALL | `sa_detect` | Intrusion detection (rootkit, file changes) |
| `security-password.sh` | `syspwd` | ALL | `sa_pwd` | Password policy enforcement, weak password scanner |
| `security-permissions.sh` | `sysperm` | ALL | `sa_perm` | Permission audit (SUID, world-writable, sticky) |
| `security-response.sh` | `sysresp` | Shield(4) | `sa_respond` | Incident response automation |
| `uid-guard.sh` | `svcuid` | ALL | `ug_check` | UID/GID guard (detect unauthorized users) |
| `canary.sh` | `svctrap` | ALL | `ca_plant/monitor` | Canary file planting + monitoring |
| `threat.sh` | `systhr` | Shield(4), Filter(3) | `th_scan` | Threat intelligence + IP reputation |
| `veil.sh` | `svcveil` | ALL | `vl_apply` | Process/service identity obfuscation |

### NETWORKING TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `wireguard.sh` | `cfgwg` | ALL | `wg_manage` | WireGuard interface management |
| `firewalld.sh` | `svcfw` | ALL | `fw_manage` | firewalld/nftables rule management |
| `nftables.sh` | `cfgnft` | Shield(4), Filter(3) | `nf_manage` | nftables rule builder |
| `network-control.sh` | `cfgnet` | Shield(4) | `nc_manage` | Network interface control |
| `network-status.sh` | `sysnet` | ALL | `ns_check` | Network diagnostics (latency, throughput, DNS) |
| `traffic.sh` | `systraf` | Proxy(2), Shield(4) | `tf_monitor` | Traffic analysis + anomaly detection |
| `ssh.sh` | `cfgssh` | ALL | `ssh_manage` | SSH hardening + key management |
| `tls.sh` | `cfgtls` | Proxy(2), Origin(5) | `tls_manage` | TLS cert management + OCSP |
| `dns.sh` | `cfgdns` | DNS(1) | `dns_manage` | DNS zone management |
| `bpf.sh` | `sysbpf` | Shield(4), Filter(3) | `bpf_load` | eBPF packet filter programs |

### MONITORING TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `runtime.sh` | `sysrun` | ALL | `rt_check` | Runtime health (CPU, mem, disk, load) |
| `runtime-health.sh` | `syshlt` | ALL | `rt_health` | Deep health check (services, ports, certs) |
| `runtime-logs.sh` | `sysrlg` | ALL | `rt_logs` | Log aggregation + anomaly detection |
| `runtime-services.sh` | `sysrsv` | ALL | `rt_services` | Service status monitoring |
| `runtime-update.sh` | `sysupd` | ALL | `rt_update` | OS/package update manager |
| `runtime-verify.sh` | `sysver` | ALL | `rt_verify` | Config verification + drift detection |
| `watchdog.sh` | `svcwdog` | ALL | `ww_monitor` | Service watchdog (auto-restart crashed services) |
| `logs.sh` | `svclog` | ALL | `lm_monitor` | Log rotation + compression |
| `cron.sh` | `cfgcron` | ALL | `cr_manage` | Cron job management + audit |
| `disk.sh` | `sysdsk` | ALL | `dk_check` | Disk usage monitoring + alerts |
| `services.sh` | `svcsvc` | ALL | `sv_manage` | systemd service orchestration |

### BACKUP & DATA TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `backup.sh` | `cfgbak` | Origin(5), Engine(6) | `bk_run` | Full backup (DB + files + configs) |
| `data-backup.sh` | `cfgdbk` | Origin(5), Engine(6) | `db_backup` | Database-specific backup |
| `data-restore.sh` | `cfgdrs` | Origin(5), Engine(6) | `db_restore` | Database restore from backup |
| `data-integrity.sh` | `sysint` | Origin(5), Engine(6) | `di_check` | Data integrity verification (checksums) |
| `restore.sh` | `cfgrst` | Origin(5), Engine(6) | `bk_restore` | Full system restore |
| `encrypt.sh` | `svcenc` | ALL | `enc_manage` | File/data encryption utilities |
| `files.sh` | `svcfile` | ALL | `fm_check` | File operations + integrity |

### IDENTITY & ACCESS TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `users.sh` | `svcusr` | ALL | `usr_manage` | User account management + SSH key rotation |
| `permissions.sh` | `svcperm` | ALL | `per_rotate` | Permission hardening + SUID audit |
| `hsm.sh` | `syshsm` | Engine(6) | `hsm_manage` | Hardware security module interface |

### CRYPTO & PAYMENT TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `wallet_guardian.sh` | `paymail` | Engine(6) | `wg_guard` | Crypto wallet monitoring + balance alerts |

### DNS / GHOST PROTOCOL TOOLS

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `ghost_dns_manager.sh` | `cfgdns` | DNS(1) | `gd_manage` | Ghost DNS zone rotation |
| `ghost_heartbeat.sh` | `svcbeat` | ALL | `hb_send` | Ghost mesh heartbeat |
| `ghost_attestation.sh` | `sysatt` | Shield(4) | `ga_attest` | Node attestation verification |
| `ghost_canary_manager.sh` | `svctrap` | Shield(4) | `gc_manage` | Canary deployment orchestration |
| `ghost_deadman.sh` | `sysdmn` | Shield(4) | `dm_check` | Dead man's switch |
| `ghost_mtls_manager.sh` | `cfgmtls` | Shield(4), Proxy(2) | `mt_manage` | mTLS certificate management |
| `ghost_shield_bootstrap.sh` | `svcboot` | Shield(4) | `bs_init` | Shield node bootstrap |
| `ghost_shield_l4_config.sh` | `cfgl4` | Shield(4) | `l4_config` | Layer 4 load balancer config |
| `ghost_traffic_monitor.sh` | `systraf` | Shield(4) | `gt_monitor` | Ghost traffic analysis |

### 365-BRANDED TOOLS (Need Rebranding)

| Legacy Name | Disguise Name | Node(s) | Agent Command | Description |
|------------|--------------|---------|---------------|-------------|
| `365-domains.sh` | `cfgdom` | DNS(1), Shield(4) | `dom_manage` | Domain management |
| `365-email.sh` | `cfgeml` | Engine(6) | `em_manage` | Email relay management |
| `365-engine-bridge.sh` | `svcbridge` | Shield(4) | `eb_relay` | Engine communication bridge |
| `365-files.sh` | `svcfmgr` | Origin(5) | `fmgr_sync` | File sync manager |
| `hello.sh` | `hello` | ALL | — | 3-phase handshake init |

---

## Per-Node Tool Deployment Map

### Node 001 — DNS (80.78.19.57) — Cover: "GoDaddy DNS"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `bind-operator`
```
cfgdns, svcbeat, svclock, sysaud, sysdet, svcuid, cfgwg, cfgssh, sysnet,
sysrun, syshlt, sysupd, svcwdog, svcenc, svcveil, cfgcron, sysdsk, hello
```

### Node 002 — Proxy (107.189.23.194) — Cover: "Cloudflare CDN"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `cache-maint`
```
svcbeat, svclock, sysaud, sysdet, svcuid, cfgwg, cfgssh, cfgtls, cfgmtls,
sysnet, systraf, sysrun, syshlt, sysupd, svcwdog, svcenc, svcveil, cfgcron, sysdsk, hello
```

### Node 003 — Filter (91.229.239.29) — Cover: "Javapipe WAF"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `net-monitor`
```
svcbeat, svclock, sysaud, sysdet, svcuid, cfgwg, cfgssh, cfgnft, sysbpf,
sysnet, systhr, sysrun, syshlt, sysupd, svcwdog, svcenc, svcveil, cfgcron, sysdsk, hello
```

### Node 004 — Shield (194.36.190.111) — Cover: "Stake Firewall"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `s3rv1c3agent`
```
svcbeat, svcboot, svclock, svcrotate, svctrap, sysaud, sysauth, sysdet, sysresp,
svcuid, cfgwg, cfgssh, cfgnft, cfgnet, cfgl4, sysbpf, sysnet, systraf, systhr,
sysatt, sysdmn, svcbridge, svcveil, sysrun, syshlt, sysupd, svcwdog, svcenc,
cfgcron, sysdsk, cfgdom, hello
```

### Node 005 — Origin (89.127.235.207) — Cover: "Supplements Store"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `php-f8m`
```
svcbeat, svclock, svcpass, svcperm, svcfile, sysaud, sysauth, sysdet, svcuid,
cfgwg, cfgssh, cfgtls, sysnet, sysrun, syshlt, sysrlg, sysrsv, sysupd, sysver,
svcwdog, cfgbak, cfgdbk, cfgdrs, cfgrst, sysint, svcenc, svcveil, cfgcron, sysdsk,
svcfmgr, hello
```

### Node 006 — Engine (76.13.222.157) — Cover: "chess.io Mail"
**Deploy path:** `/opt/apache/tools/`
**Service user:** `mail-svc`
```
ALL currently deployed tools (24) PLUS:
sysaud, sysdet, svcuid, cfgwg, cfgssh, sysnet, sysrun, syshlt, sysrlg, sysrsv,
sysupd, sysver, svcwdog, cfgbak, cfgdbk, cfgdrs, cfgrst, sysint, svcenc, svcveil,
cfgcron, sysdsk, cfgeml, syshsm, syscrypt, syspwd, hello
```

---

## Rotation Schedule

| Asset | Frequency | Tool | Exempt |
|-------|-----------|------|--------|
| MySQL/MariaDB service passwords | 30 days | `svcpass` (password.sh) | root, admin accounts |
| WireGuard keys | 90 days | `svcrotate` (ghost_key_rotation.sh) | — |
| SSH host keys | 90 days | `svcrotate` | admin user keys (Y:\) |
| HMAC bridge keys | 60 days | `svcrotate` | — |
| SSL/TLS certs | Auto (certbot) | `cfgtls` | — |
| Service tokens | 30 days | `svcpass` | — |
| Canary files | 7 days | `svctrap` | — |

### NEVER ROTATE — EXEMPT
- **Admin user SSH keys** — live on Y:\ encrypted HD, disconnected when live
- **Root password** — stays as-is on all nodes  
- **Administrator password** — stays as-is
- Y:\ encryption keys — hardware-level

---

## Adaptation Requirements

All legacy scripts need these changes before deployment:

1. **Remove `365` branding** — replace with node-appropriate naming
2. **Replace `source common.sh`** — adapt to use `se_client.sh` or standalone
3. **Replace `/opt/365/`** paths → `/opt/apache/`
4. **Replace `/etc/365/`** paths → `/opt/sysc/engine/config/`
5. **Replace `snowdaddy`** → `admin` (our admin user)
6. **Replace `phoenix`** → appropriate service user per node
7. **Strip all comments** before deployment (Rule 21)
8. **Minify** — no indentation, no blank lines (Rule 22)
9. **chmod 750, chown root:root** on deployment

---

## Encrypted Vault System

### Architecture
All tool scripts are **encrypted at rest** (AES-256-CBC, PBKDF2, 100k iterations). No plaintext scripts on disk.

```
s3rv1c3agent → tvault exec <tool> [args...]
    → fetch key from Shield (10.69.69.1:8302) over WireGuard
    → decrypt to /dev/shm (RAM-only tmpfs)
    → chmod 700 → execute → shred from RAM
    → send pulse to Origin topology dashboard
```

### Components

| Component | Path | Node | Purpose |
|-----------|------|------|---------|
| `tvault` | `/opt/apache/tools/tvault` | ALL 6 nodes | Vault executor — decrypt, exec, shred, pulse |
| `keyserv` | `/opt/apache/tools/keyserv` | Shield (004) ONLY | Key distribution server (HMAC-auth, WG-bound) |
| `*.enc` | Spread across 5 dirs (see below) | ALL | Encrypted tool scripts |
| `*.identity` | `/opt/sysc/engine/config/<nid>.identity` | ALL | Node identity (plaintext) |
| `readme.txt` | `/opt/sysc/engine/config/readme.txt` | ALL | Cover story decoy file |
| `vault-keyserv.service` | `/etc/systemd/system/` | Shield ONLY | systemd unit for keyserv |

### Vault Directory Spread (Defense in Depth)
Encrypted `.enc` files are **NOT** stored in a single directory. They are spread across 5 paths that look like standard Linux system directories. If an attacker finds one, they don't get the full toolkit.

| Directory | Looks Like | Tools Routed Here |
|-----------|-----------|-------------------|
| `/usr/lib/firmware/.d/` | Firmware blobs | `svc*` — service tools (svcbeat, svclock, svcpass, etc.) |
| `/var/cache/ldconfig/.d/` | Linker cache | `sys*` — system tools (sysaud, sysdet, sysnet, etc.) |
| `/usr/share/misc/.d/` | Misc data files | `cfg*` — config tools (cfgwg, cfgssh, cfgtls, etc.) |
| `/var/lib/rpm/.d/` | RPM database | `*mail`, `pay*`, `ask*`, etc. — engine/mail tools |
| `/opt/apache/tools/vault/` | Apache modules | Everything else (hello, s3rv1c3agent, etc.) |

**Routing logic** (`_pick_vault` in tvault):
- Tool name prefix determines directory
- `tvault list` scans ALL 5 dirs
- `tvault exec` searches ALL 5 dirs to find the tool
- All dirs are `chmod 700 root:root`

### Key Server (Shield)
- Listens on `10.69.69.1:8302` (WireGuard only, NOT public)
- Each node has unique encryption key stored at `/opt/sysc/engine/vault/node_keys/<nid>.key`
- Keys generated from `/dev/urandom` (64 bytes, hex-encoded)
- HMAC-SHA256 authentication on every request (same as s3rv1c3agent)
- Clock skew tolerance: 30 seconds
- Runs as `vault-keyserv.service` under systemd

### tvault Commands
| Command | Description |
|---------|-------------|
| `tvault exec <tool> [args]` | Decrypt → execute → shred → pulse |
| `tvault encrypt <tool> <file>` | Encrypt a plaintext script into vault |
| `tvault heartbeat` | Send CPU/RAM/disk/load metrics to topology |
| `tvault list` | List encrypted tools in vault |
| `tvault test <tool>` | Decrypt + bash syntax check |
| `tvault flush-cache` | Wipe cached key from /dev/shm |

---

## Pulse / Heartbeat Telemetry

### Flow
Every tvault tool execution sends a **pulse** to Origin's topology dashboard:
```
Node → tvault exec → tool runs → curl POST to Origin (async/background)
                                    ↓
                            /dashboard/api/fleet/pulse.php
                                    ↓
                            node_pulses table + nodes.last_seen
                                    ↓
                            Topology tab shows real-time activity
```

### Pulse API Endpoint
**URL:** `https://10.69.69.2:443/dashboard/api/fleet/pulse.php`
**File:** `Y:\5\dashboard\api\fleet\pulse.php`
**Access:** WireGuard IPs only (10.69.69.1, 10.69.69.2, 127.0.0.1)

| Action | Method | Purpose |
|--------|--------|---------|
| `heartbeat` | POST | Full metrics update (CPU, RAM, disk, load, uptime) |
| `pulse` | POST | Single tool event (exec, encrypt, decrypt) |
| `batch_pulse` | POST | Multiple events in one request |
| `tool_event` | POST | Alias for pulse |
| `vault_event` | POST | Vault-specific event (key fetch, decrypt, encrypt) |

### Database Table: `node_pulses`
**Database:** `store` (on Origin node 005)

| Column | Type | Purpose |
|--------|------|---------|
| `id` | BIGINT AUTO_INCREMENT | Primary key |
| `node_id` | VARCHAR(10) | 6-digit node identifier |
| `event_type` | VARCHAR(50) | `tool_exec`, `vault_decrypt`, `vault_encrypt`, `heartbeat` |
| `tool_name` | VARCHAR(50) | Disguise name of tool executed |
| `result` | VARCHAR(100) | `ok` or `err:<exit_code>` |
| `duration_ms` | INT UNSIGNED | Execution time in milliseconds |
| `created_at` | DATETIME | Event timestamp |

Indexes: `(node_id, created_at)`, `(event_type, created_at)`

### Existing Topology Table: `nodes`
Fields updated by pulse system:
- `last_heartbeat` — timestamp of last full heartbeat
- `last_seen` — timestamp of any activity (pulse or heartbeat)
- `is_reachable` — set to 1 on any successful pulse
- `status_code` — HTTP-style status (200 = healthy)
- `metrics` — JSON blob: `{"cpu":25,"ram":60,"disk":34,"load":0.5,"uptime":847200}`

---

## Deployment Status

### Per-Node Deployment (2026-06-11)

| Node | ID | IP | OS | tvault | identity | story | keyserv | WG→Shield |
|------|-----|-----|-----|--------|----------|-------|---------|-----------|
| 001 DNS | 199335 | 80.78.19.57 | Ubuntu 24.04 | ✅ | ✅ | ✅ Margit's Bread | — | ✅ 12.5ms |
| 002 Proxy | 244939 | 107.189.23.194 | AlmaLinux 9.7 | ✅ | ✅ | ✅ Last Packet | — | ✅ 2.25ms |
| 003 Filter | 333941 | 91.229.239.29 | AlmaLinux 9.8 | ✅ | ✅ | ✅ Road Journal | — | ✅ |
| 004 Shield | 414342 | 194.36.190.111 | AlmaLinux 9.7 | ✅ | ✅ | ✅ Fortune Cookies | ✅ RUNNING | localhost |
| 005 Origin | 558201 | 89.127.235.207 | AlmaLinux 9.8 | ✅ | ✅ | ✅ Iceland Letter | — | ✅ |
| 006 Engine | 669427 | 76.13.222.157 | AlmaLinux 9.8 | ✅ | ✅ | ✅ Chess Club | — | ✅ 171ms |

### Files Created This Session

| File | Location | Purpose |
|------|----------|---------|
| `tvault` | `Y:\done\legacy\bash\build\tvault` → all nodes `/opt/apache/tools/tvault` | Vault executor |
| `keyserv` | `Y:\done\legacy\bash\build\keyserv` → Shield `/opt/apache/tools/keyserv` | Key distribution |
| `pulse.php` | `Y:\5\dashboard\api\fleet\pulse.php` → Origin `/var/www/dashboard/api/fleet/` | Pulse API endpoint |
| `*.identity` | `Y:\tmp\deploy\<nid>.identity` → each node `/opt/sysc/engine/config/<nid>.identity` | Node identity |
| `readme.txt` | Per-node cover story → `/opt/sysc/engine/config/readme.txt` | Decoy file |
| `vault-keyserv.service` | Shield `/etc/systemd/system/` | systemd unit |
| `create_pulses.sql` | `Y:\tmp\deploy\create_pulses.sql` | DB migration |
| `TOOL_MANIFEST.md` | `Y:\documents\TOOL_MANIFEST.md` | This file (source of truth) |
| `stories.md` | `Y:\done\legacy\stories.md` | Cover stories (006+007 merged) |

### Rules Added This Session (rules.md)
- **Rule 41** — Per-Node Tool Isolation
- **Rule 42** — Tool Disguise Naming
- **Rule 43** — Tool Manifest (Source of Truth)
- **Rule 44** — Credential Rotation Policy
- **Rule 45** — Legacy Script Adaptation
- **Rule 46** — Download Infrastructure
- **Rule 47** — Documentation Hierarchy
- **Rule 48** — Idempotency
- **Rule 49** — Node Identity System (stories, 6-digit IDs)
- **Rule 50** — Encrypted Tool Vault (Zero-Trust Execution)
- **Rule 51** — Per-Service WireGuard Isolation (random codenames, randomized ports)

---

## Per-Service WireGuard Tunnels (Rule 51)

### ⚠️ THIS MAPPING NEVER LEAVES Y:\ — THE ONLY PLACE CODENAME → PURPOSE EXISTS ⚠️

Each inter-node service gets its own isolated WireGuard tunnel. Interface names are random 3-char codenames — reveal nothing.

| Codename | Service | Purpose | Nodes Involved | Listen Port | Subnet |
|----------|---------|---------|----------------|-------------|--------|
| `wg-k7m` | Tool Vault | tvault ↔ keyserv key fetch | All ↔ Shield | TBD | 10.70.1.0/30 |
| `wg-p2n` | Pulse Telemetry | Heartbeat/tool events | All → Shield → Origin | TBD | 10.70.1.4/30 |
| `wg-r3x` | Payment Bridge | Stripe/crypto processing | Origin ↔ Shield ↔ Engine | TBD | 10.70.2.0/30 |
| `wg-d4q` | DB Write | Engine → Origin DB writes | Engine → Shield → Origin | TBD | 10.70.2.4/30 |
| `wg-f8j` | Email Bridge | Email dispatch | Origin ↔ Shield ↔ Engine | TBD | 10.70.3.0/30 |
| `wg-a1v` | Fleet Commands | SSH relay / fleet mgmt | Shield → All | TBD | 10.70.3.4/30 |
| `wg-t6w` | Tron Signer | USDT/USDC signing | Engine ↔ Shield (local) | TBD | 10.70.4.0/30 |

### Implementation Rules
1. **Port generation**: `shuf -i 10000-60000 -n 1` per tunnel — store here, never regenerate
2. **Subnet**: Each tunnel gets `/30` from `10.70.0.0/16` (point-to-point, 2 usable IPs)
3. **Keys**: Each tunnel gets unique keypair. Private keys stored encrypted in vault, never plaintext on disk
4. **Config**: `/etc/wireguard/wg-k7m.conf` — each tunnel is a separate `wg-quick@wg-k7m.service`
5. **Existing wg0**: Keep for bootstrap/SSH only. All services migrate to dedicated tunnels
6. **Shield firewall**: nftables routes between tunnel interfaces, never cross-exposes
7. **Observer sees**: `wg0`, `wg-k7m`, `wg-p2n` — looks like random VPN tunnels, reveals nothing

---

## Audit Remediation Log (2026-06-11)

### Files Fixed & Deployed (Rule 52 Compliant)

| File | Node | Fix | Tested |
|------|------|-----|--------|
| `dashboard/core/payment_client.php` | Origin | SSL VERIFYPEER=true, VERIFYHOST=2 (was false/0) | ✅ PASS |
| `public/api/handlers/checkout.handler.php` | Origin | Added `get_config` action (returns Stripe PK, enabled methods) | ✅ PASS |
| `dashboard/api/system/heartbeat.php` | Origin | Session keepalive (was 4-line stub) | ✅ PASS |
| `dashboard/api/system/search.php` | Origin | Order search API (was 4-line stub) | ✅ PASS |
| `dashboard/api/system/engine_status.php` | Origin | Dynamic node_id lookup (was hardcoded 669427) | ✅ PASS |
| `dashboard/assets/js/engine_panel.js` | Origin | Dynamic engineNodeId from API (was hardcoded 669427) | ✅ PASS |
| `dashboard/modules/overview/overview_data.php` | Origin | Dynamic engine node lookup (was hardcoded 669427) | ✅ PASS |
| `public/api/email-bridge.php` | Origin | NEW — HTTP wrapper for EmailBridge class (was 404) | ✅ PASS |
| `engine-scripts/dbwrite` | Engine | Redeployed clean version (live had hardcoded DB creds) | ✅ PASS |
| `engine/wallets/tron/tron-signer/index.js` | Engine | HMAC auth + input validation (was ZERO auth) | ✅ PASS |

### Duplicate Systems Found
| Duplicate | Survivor | Status |
|-----------|----------|--------|
| `private/p1a2y3m4_bridge.php` (raw TCP socket) | `public/system/payment_bridge.php` (curl + HMAC) | p1a2y3m4 still used by overview_data.php — DO NOT DELETE yet |
| `dashboard/api/system/heartbeat.php` (session) | `dashboard/api/heartbeat.php` (node health) | NOT duplicates — different purposes |

